Identity-based networking shows why “good enough” access is costly

At a glance

What this is: This is a Tailscale analysis of a Forrester TEI study showing that identity-based networking can reduce infrastructure, friction, and exposure while delivering 213% ROI in a modeled enterprise.

Why it matters: It matters to IAM practitioners because network access is increasingly an identity problem, and the same control patterns that reduce access sprawl also inform NHI, human access, and zero trust governance.

By the numbers:

• The study found that Tailscale delivered a 213% ROI with a payback in under six months.
• Time spent managing remote access dropped by 60%.

👉 Read Tailscale's analysis of the Forrester TEI study on identity-based networking

Context

Identity-based networking treats access as a function of who or what is connecting, rather than where it sits on the network. That matters because the traditional perimeter model tends to accumulate VPN layers, access exceptions, and operational workarounds that are difficult to govern consistently across human users, service accounts, and machine workloads.

The article’s core claim is that simplifying network access reduces both cost and risk, because the same complexity that creates helpdesk friction also expands the blast radius of a compromise. For IAM and NHI teams, the useful lesson is that connection policy is now part of identity governance, not a separate network concern.

Key questions

Q: How should security teams govern infrastructure access for both people and workloads?

A: They should use one policy model that covers human administrators, service accounts, and automation identities across all infrastructure layers. That model should combine discovery, strong authentication, short-lived access, and audit trails so the team can answer who accessed what, when, and why without stitching together disconnected tools.

Q: Why does simplifying remote access improve both security and operations?

A: Every added access layer introduces configuration drift, support overhead, and more opportunities for broad trust to persist. Simplifying the stack reduces the number of places where policy can fail, which lowers helpdesk load and narrows the blast radius if an identity is compromised.

Q: What breaks when organisations keep treating VPN access as a trusted internal path?

A: The main failure is that a VPN turns successful authentication into broad network reach, which creates a large blast radius if credentials are stolen or bypassed. Once connected, attackers can often discover, pivot, and persist more easily than they could through a narrowly scoped application access model.

Q: How do teams know whether identity detection is actually reducing risk?

A: Look for fewer unresolved high-risk sessions, faster containment of suspicious privilege use, and better analyst prioritisation. A strong programme changes how quickly the team can identify, contain, and explain identity misuse. If alerts rise but response quality does not improve, the control is producing noise rather than reduction in risk.

Technical breakdown

Identity-based network access vs perimeter networking

Identity-based networking shifts the control point from network location to authenticated identity, device posture, and policy. Instead of granting broad VPN reach into a segment, the system evaluates whether a user, workload, or device can connect to a specific destination. This reduces implicit trust, removes lateral movement opportunities created by flat access, and aligns more closely with zero trust design. In practice, the architecture depends on strong identity binding, policy enforcement at connection time, and visibility into every connection decision.

Practical implication: map network access paths to identity policy so you can replace broad connectivity with task-scoped entitlements.

Why infrastructure simplification reduces security overhead

Legacy remote access stacks rarely exist alone. They tend to accumulate load balancers, NAT layers, routing exceptions, appliance management, and manual support procedures that all need configuration, monitoring, and incident response. Each extra component adds failure modes and more places where access rules drift. Simplification matters because reducing the number of control layers also reduces the number of places where attackers or administrators can introduce inconsistency. This is a governance issue as much as an architecture issue.

Practical implication: inventory the full access stack, not just the VPN, and retire redundant control layers that expand operational debt.

Blast radius control at the connection layer

Blast radius is the amount of damage an attacker or misconfiguration can cause once access is obtained. Connection-level least privilege limits what identities can reach, so compromise of one account does not automatically expose the wider environment. Device-aware policy and default-deny routing tighten that boundary further by requiring each session to prove context before access is granted. This is especially relevant where human identity, NHI, and admin paths intersect, because over-broad connectivity often turns one credential into many reachable targets.

Practical implication: enforce least privilege at the connection layer and review which identities can still traverse broad internal paths.

Threat narrative

Attacker objective: The attacker aims to convert one reachable identity into broad internal access that supports lateral movement and larger-scale compromise.

1. Entry occurs through broad network access paths that permit a valid identity to reach far more internal resources than it needs.
2. Escalation follows when that access is combined with layered infrastructure and permissive routing that make lateral movement easier.
3. Impact is amplified because a single compromised identity can reach a wider blast radius, increasing breach cost and operational disruption.

NHI Mgmt Group analysis

Identity-based networking is now an identity governance problem, not just a transport problem. When access is defined by identity and policy, network design starts to overlap with IAM, PAM, and machine access governance. That means the programme has to account for who or what is allowed to connect, under what conditions, and with what scope. Teams that ignore this intersection leave a gap between identity policy and actual connectivity.

Broad connectivity is a standing privilege problem in disguise. VPN-era access often behaves like persistent privilege because once users connect, they can traverse far more of the environment than their task requires. That creates the same governance problem practitioners already see in over-permissioned accounts and unmanaged secrets: the access exists longer and reaches farther than intended. The practical conclusion is to treat network reach as an entitlement that must be constrained and reviewed.

Infrastructure simplification changes the economics of control ownership. The more layers a team carries around remote access, the more likely responsibility fragments between network, IAM, endpoint, and security operations. That fragmentation weakens accountability and slows remediation. A flatter, policy-driven model does not eliminate governance work, but it concentrates it where identity teams can actually manage access decisions.

Zero trust becomes operational only when connectivity is continuously contextual. The article reinforces a broader market shift toward policy at connection time, rather than trust based on network proximity. That direction is consistent with zero trust thinking and increasingly relevant for NHI and AI-assisted operations, where machine access can spread faster than human review cycles. Practitioners should expect identity-aware networking to become part of access governance baselines.

What this signals

Identity-aware networking will increasingly be judged on entitlement quality, not just connectivity uptime. As access becomes more policy-driven, programme owners will need to show that internal reach is narrow, reviewable, and aligned to business function. The practical signal is whether the access model can support zero trust without creating new administrative sprawl.

Standing network reach is becoming as hard to defend as standing privileges in IAM. Once organisations recognise that broad internal connectivity creates the same kind of persistent exposure as over-permissioned accounts, access design will move closer to lifecycle governance. That is where NHI and human access programmes converge: both need tighter scoping, better review, and stronger ownership.

For practitioners

• Map network access to identity entitlement Inventory which users, service accounts, and workloads can reach which internal resources, then remove broad paths that are not tied to a specific business function. Treat every internal route as an entitlement that needs an owner and a review cycle.
• Retire layered remote access dependencies Document the full stack supporting remote connectivity, including VPNs, load balancers, NAT, and manual support processes, then remove duplicated controls where they add complexity without improving assurance.
• Enforce default-deny connection policy Require an explicit policy decision before any session can connect to a destination, and restrict that policy to the smallest viable set of resources. This reduces the blast radius of a stolen credential or misconfigured workload.
• Extend identity governance to machine access Apply the same governance discipline used for human access reviews to service accounts and automation identities that can use network connectivity to reach internal systems.

Key takeaways

• Identity-based networking reframes remote access as an access governance problem, not an infrastructure convenience.
• The quantified gains in the study come from removing complexity, reducing friction, and narrowing blast radius at the connection layer.
• Practitioners should govern network reach the same way they govern privilege, because broad connectivity functions like standing access.

Key terms

• Identity-based networking: An access model that grants connectivity based on authenticated identity and policy rather than network location. It replaces broad perimeter trust with task-specific rules that can be applied to users, devices, and workloads across environments.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

What's in the full article

Tailscale's full blog post covers the operational detail this post intentionally leaves for the source:

• Forrester TEI modelling assumptions behind the 3,000-employee composite enterprise
• Breakdown of the $1.2 million present value from retired remote access infrastructure
• Productivity and IT efficiency calculation methods behind the 60% and 50% reductions
• Security risk model used to estimate the 70% reduction in exposure to breach costs

👉 The full Tailscale post covers the ROI model, cost components, and risk assumptions in more detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives security practitioners a structured way to apply identity discipline across access, lifecycle, and privilege decisions.